Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
396,035 CVEs1,717 in CISA KEV17,157 with EPSS ≥ 10%25,049 with a public exploitUpdated 22 September 2026
25,049 results · page 122 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2014-9347 | SQL injection vulnerability in dosearch.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL commands via the words_exact parameter. | EXPLOITHIGH 7.5EPSS 1.31% | 8 December 2014 |
| CVE-2014-9345 | SQL injection vulnerability in Guruperl.net Advertise With Pleasure! | EXPLOITHIGH 7.5EPSS 2.35% | 8 December 2014 |
| CVE-2014-9344 | Cross-site request forgery (CSRF) vulnerability in Snowfox CMS before 1.0.10 allows remote attackers to hijack the authentication of administrators for requests that add a new admin account via a submit action in the admin/accounts/create uri to snowfox/. | EXPLOITMEDIUM 6.8EPSS 2.34% | 8 December 2014 |
| CVE-2014-9305 | SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a… | EXPLOITMEDIUM 6.5EPSS 3.61% | 8 December 2014 |
| CVE-2014-9265 | Stack-based buffer overflow in the BackupToAvi method in the CNC_Ctrl ActiveX control in Samsung SmartViewer allows remote attackers to execute arbitrary code via unspecified vectors. | EXPLOITMEDIUM 6.8EPSS 4.02% | 8 December 2014 |
| CVE-2014-5462 | Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to interface/super/edit_layout.php; (2) form_patient_id, (3) form_drug_name,… | EXPLOIT ✓MEDIUM 6.5EPSS 1.99% | 8 December 2014 |
| CVE-2014-9218 | libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password. | EXPLOITMEDIUM 5.0EPSS 10.7% | 8 December 2014 |
| CVE-2014-4880 | Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arbitrary code via an RTSP PLAY request with a long Authorization header. | EXPLOIT ✓HIGH 7.5EPSS 70.7% | 8 December 2014 |
| CVE-2014-9304 | Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed… | EXPLOITHIGH 7.5EPSS 8.11% | 7 December 2014 |
| CVE-2014-9303 | EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator username and password via a URL starting with an ASCII character o through z or A through D, different vectors than CVE-2014-8868. | EXPLOITHIGH 7.8EPSS 3.31% | 7 December 2014 |
| CVE-2014-9302 | Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition 5.0.a and earlier allows remote attackers to trigger outbound requests via a crafted URI in… | EXPLOIT ✓MEDIUM 5.0EPSS 2.01% | 7 December 2014 |
| CVE-2014-9301 | Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbitrary files via a crafted URI in… | EXPLOIT ✓MEDIUM 6.4EPSS 3.93% | 7 December 2014 |
| CVE-2014-8868 | EntryPass N5200 Active Network Control Panel does not properly restrict access, which allows remote attackers to obtain the administrator username and password, and possibly other sensitive information, via a request to /4. | EXPLOITHIGH 7.8EPSS 6.99% | 7 December 2014 |
| CVE-2014-8877 | The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/,… | EXPLOITHIGH 10.0EPSS 14.4% | 5 December 2014 |
| CVE-2014-4703 | lib/parse_ini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts flag. | EXPLOIT ✓LOW 2.1EPSS 1.08% | 5 December 2014 |
| CVE-2014-9215 | SQL injection vulnerability in the CheckEmail function in includes/functions.class.php in PBBoard 3.0.1 before 20141128 allows remote attackers to execute arbitrary SQL commands via the email parameter in the register page to index.php. | EXPLOITHIGH 7.5EPSS 2.33% | 5 December 2014 |
| CVE-2014-9144 | Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metacharacters in the ping field (setobject_ip parameter). | EXPLOITHIGH 7.5EPSS 8.56% | 5 December 2014 |
| CVE-2014-9143 | Open redirect vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the failrefer parameter. | EXPLOITMEDIUM 4.3EPSS 3.98% | 5 December 2014 |
| CVE-2014-9142 | Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to inject arbitrary web script or HTML via the failrefer parameter. | EXPLOITMEDIUM 4.3EPSS 3.22% | 5 December 2014 |
| CVE-2014-8800 | Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fb_login_button parameter in a… | EXPLOITMEDIUM 4.3EPSS 3.75% | 5 December 2014 |
| CVE-2014-3997 | SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before… | EXPLOIT ✓HIGH 7.5EPSS 13.1% | 5 December 2014 |
| CVE-2014-3996 | SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager Pro (PMP) and Password Manager Pro Managed Service… | EXPLOIT ✓HIGH 7.5EPSS 38.4% | 5 December 2014 |
| CVE-2014-7868 | Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in… | EXPLOIT ×2HIGH 7.5EPSS 73.3% | 4 December 2014 |
| CVE-2014-6036 | Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via… | EXPLOITMEDIUM 6.4EPSS 36.3% | 4 December 2014 |
| CVE-2014-6035 | Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. | EXPLOITHIGH 7.5EPSS 28.8% | 4 December 2014 |
| CVE-2014-6034 | Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote… | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 79.0% | 4 December 2014 |
| CVE-2014-5446 | Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. | EXPLOITMEDIUM 5.0EPSS 54.7% | 4 December 2014 |
| CVE-2014-5445 | Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the… | EXPLOITMEDIUM 5.0EPSS 98.0% | 4 December 2014 |
| CVE-2014-9243 | Multiple cross-site scripting (XSS) vulnerabilities in WebsiteBaker 2.8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to wb/admin/admintools/tool.php or (2) section_id parameter to edit_module_files.php, (3)… | EXPLOITMEDIUM 4.3EPSS 2.48% | 3 December 2014 |
| CVE-2014-9242 | SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 allows remote attackers to execute arbitrary SQL commands via the page_id parameter. | EXPLOITHIGH 7.5EPSS 2.08% | 3 December 2014 |
| CVE-2014-9241 | Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) type parameter to report.php, (2) signature parameter in a do_editsig action… | EXPLOITMEDIUM 4.3EPSS 3.43% | 3 December 2014 |
| CVE-2014-9240 | SQL injection vulnerability in member.php in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the question_id parameter in a do_register action. | EXPLOITHIGH 7.5EPSS 3.48% | 3 December 2014 |
| CVE-2014-9237 | SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request. | EXPLOIT ×2HIGH 7.5EPSS 2.10% | 3 December 2014 |
| CVE-2014-9236 | Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) photographer_id or (2) _crumb parameter. | EXPLOITMEDIUM 4.3EPSS 2.65% | 3 December 2014 |
| CVE-2014-9235 | Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter… | EXPLOITMEDIUM 6.5EPSS 2.00% | 3 December 2014 |
| CVE-2014-8775 | MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. | EXPLOITMEDIUM 5.0EPSS 2.76% | 3 December 2014 |
| CVE-2014-8774 | Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the context_key parameter. | EXPLOITMEDIUM 4.3EPSS 1.47% | 3 December 2014 |
| CVE-2014-8773 | MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via a (2) long string in the CSRF token parameter. | EXPLOITMEDIUM 6.8EPSS 1.13% | 3 December 2014 |
| CVE-2014-9141 | The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, which allows local users to execute arbitrary code by modifying this program. | EXPLOITHIGH 7.2EPSS 1.21% | 3 December 2014 |
| CVE-2014-9181 | Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. | EXPLOITMEDIUM 5.0EPSS 9.48% | 2 December 2014 |
| CVE-2014-9179 | Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the "URL (optional)" field in a new ticket. | EXPLOITMEDIUM 4.0EPSS 3.49% | 2 December 2014 |
| CVE-2014-9178 | Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1)… | EXPLOIT ✓HIGH 7.5EPSS 4.63% | 2 December 2014 |
| CVE-2014-9175 | SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the table_id parameter in a get_wdtable action to wp-admin/admin-ajax.php. | EXPLOITHIGH 7.5EPSS 4.59% | 2 December 2014 |
| CVE-2014-9173 | SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the gpid parameter. | EXPLOIT ×2HIGH 7.5EPSS 5.02% | 2 December 2014 |
| CVE-2014-9113 | CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Authenticated Users: Modify and Write) for the (1) Pfx.Engagement.WcfServices, (2) PFXEngDesktopService, (3) PFXSYNPFTService, and (4) P2EWinService… | EXPLOITHIGH 7.2EPSS 1.71% | 2 December 2014 |
| CVE-2014-8728 | SQL injection vulnerability in the login page (login/login) in Subex ROC Fraud Management (aka Fraud Management System and FMS) 7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ranger_user[name] parameter. | EXPLOITHIGH 7.5EPSS 1.20% | 2 December 2014 |
| CVE-2014-8791 | project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter. | EXPLOIT ✓MEDIUM 6.0EPSS 14.8% | 2 December 2014 |
| CVE-2014-5284 | host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary files before… | EXPLOIT ✓HIGH 7.2EPSS 2.43% | 2 December 2014 |
| CVE-2014-8801 | Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 18.0% | 28 November 2014 |
| CVE-2014-8799 | Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. | EXPLOITMEDIUM 5.0EPSS 67.6% | 28 November 2014 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.